2.4 Manage Security Aspects of Change Control ISSMP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is a key element of change documentation and tracking?

   • AUsing a single document for all changes to simplify tracking
   • BRecording the date and time of each approval
   • CEnsuring that all changes are approved by the security team
   • DDeleting change records after implementation to reduce data storage
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A healthcare organization is planning to migrate its patient records system to a new cloud-based platform. The change control process requires that all relevant stakeholders be identified and coordinated. Which of the following stakeholders MUST be included in the change control process for this migration?

   • AThe cloud service provider's sales representative
   • BThe end users of the patient records system
   • CThe organization's legal and compliance team
   • DThe external auditor who reviews the organization's financial statements
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company has a change control policy that requires all changes to be monitored after implementation to ensure they do not introduce security issues. Which of the following is an example of continuous monitoring after a change?

   • AReviewing the change request form for completeness
   • BChecking system logs and alerts for unusual activity related to the change
   • CConducting a security impact analysis before approval
   • DScheduling a follow-up meeting with the change advisory board
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A financial services company is implementing a change to its customer-facing web application that will introduce a new authentication module. The change control board (CCB) is reviewing the change request. The security team has been asked to ensure that the change does not introduce vulnerabilities. Which action should the security team take FIRST?

   • AConduct a security impact analysis to identify potential security effects of the new authentication module.
   • BApprove the change request immediately to avoid delaying the release schedule.
   • CRequire the development team to provide a list of all stakeholders involved in the change.
   • DUpdate the change control policy to include authentication requirements for all future changes.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the purpose of continuous monitoring in the context of change control?

   • ATo reduce the frequency of change requests
   • BTo replace the need for security impact analysis
   • CTo verify that the security posture remains acceptable after a change is implemented
   • DTo ensure that all changes are approved by the security team
   Reveal Solution Discussion Select an answer first